Top crypto stories of week 17, 2026
Mon 20 to Sun 26 April 2026
The 20 top stories on Kiwi News from Mon 20 to Sun 26 April 2026, ranked by upvotes, comments and clicks, with 27 comments in total. Most-shared sources: x.com, firefly.social.
Text under a title is an AI summary of the linked article.
- @arbitrum: Security Council freezes 30,766 ETH from KelpDAO exploiter (x.com)
The Arbitrum Security Council has frozen 30,766 ETH held on Arbitrum One at an address connected to the KelpDAO exploit. The Security Council acted with input from law enforcement on the exploiter's identity, and says it did so without affecting any Arbitrum users or applications. As of April 20 at 11:26pm ET, the funds had been transferred to an intermediary frozen wallet and can only be moved through further Arbitrum governance action, coordinated with relevant parties.
- @banteg: LayerZero attack was infra breach, not RPC poisoning (firefly.social)
The post argues that the LayerZero attack was an infrastructure breach inside the trust boundary, not RPC poisoning, which the author describes as an outside attacker tainting a shared lookup. According to the post, the attackers accessed LayerZero's RPC list, compromised two nodes the DVN depended on, and swapped the op-geth binaries. The malicious binary reportedly hid its IP, served forged payloads only to the DVN while giving accurate responses to scans and other callers, and then self-destructed to wipe logs and binaries.
- The zero-days are numbered (blog.mozilla.org)
Mozilla's Firefox team argues that AI models have made it possible to find and fix security vulnerabilities at a scale that gives defenders a real chance to win, and that the defects in browser code are finite. Firefox 150 includes fixes for 271 vulnerabilities identified during an initial evaluation of an early version of Claude Mythos Preview, following an earlier collaboration with Anthropic that fixed 22 security-sensitive bugs in Firefox 148. The post says the model has so far found no category or complexity of vulnerability that human researchers can find and that the model cannot, and that none of the bugs found could not have been found by an elite human researcher.
- It’s Time to Kill God Mode (chaskin.xyz)
Writing for a crypto audience, the author argues that Ethereum-based systems should eliminate "God mode," meaning administrative controls such as upgrade keys, and be made truly unstoppable. The author says the cloud is a surveillance engine, that some widely used crypto is now building stoppable code, and that Andreas Antonopoulos warned at ETH Denver 2019 that enterprise and corporate pressure would push toward stoppable code. The author adds that Ethereum is no longer early-stage, citing that core primitives like swapping, lending and stablecoins have gone through multiple iterations over eight years and that L2s have been live for over 4.5 years. The author concludes that decentralized multisigs with timelocks, though an improvement, are still control that will eventually be misused.
- @mikegoodwtf: Nouns DAO captured by @0xdusk_eth and conspirators via voting bloc (firefly.social)
Mike Goodwin, posting as @mikegoodwtf, says Nouns DAO has been captured by a small voting bloc led by Glitter Protocol founder @0xdusk_eth and anonymous accounts including @0xjanedoe2008 and @makenounsgreatagain. The post says the group stopped voting on proposals for months, which made passing proposals nearly impossible, and then gathered enough votes to decide DAO matters alone. It says they all voted on a new reserve auction price for Nouns set at 4x the daily auction price, which the post claims will likely halt income, burn daily Nouns, and prevent new buyers and voters.
- How crypto exchange Grinex shuttering poses ‘serious damage’ to Russian economy (dlnews.com)
Crypto exchange Grinex announced on Telegram that it would halt operations after allegedly suffering a cyberattack that robbed it of over 1 billion rubles, or $13 million. The platform, which handled nearly $100 billion in volume for the sanctioned stablecoin A7A5 in 2025, is the successor to the sanctioned exchange Garantex. Nick Harris, CEO of crypto asset recovery firm CryptoCare, told DL News that the closure removes an exchange Russian businesses relied on to convert rubles into usable international currency.
- Rekt - KelpDao - Rekt (rekt.news)
An attacker drained about $290 million from KelpDAO's rsETH bridge on April 18, 2026, by forging a cross-chain message that the protocol's single required verifier signed. That verifier had been reading fabricated chain data after attackers compromised RPC nodes. The stolen rsETH was deposited into Aave as collateral to borrow WETH, and Aave's TVL shed $6.28 billion in under 48 hours. North Korea's Lazarus Group is the preliminary attribution. LayerZero blamed KelpDAO's one-verifier setup, while KelpDAO said that configuration was LayerZero's documented default.
- ENS Domain History (ens.eth.sh)
- @shawmakesmagic: Vercel breach exposed thousands of npm, PyPI tokens and keys (x.com)
- April 18 LayerZero Incident: Additional Context (x.com)
On April 18, rsETH was drained from its bridging adapter through a forged cross-chain message, according to Kelp, which published this follow-up while the broader post-incident review continues. Kelp says two RPC nodes hosted by LayerZero were compromised and a simultaneous DDoS attack targeted a third, and it states that Kelp's own systems were not involved in building or operating that infrastructure. Kelp says it paused relevant contracts on Ethereum mainnet and L2s, blacklisted wallets linked to the exploiter, and engaged SEAL-911, fully mitigating a follow-up attempt to target an additional 40,000 rsETH (~$95M). Kelp also states its 1-of-1 DVN setup is the default LayerZero documents for new OFT deployments.
- @CoWSwap: CoW DAO proposes grants to reimburse victims of April 14 DNS hijack (firefly.social)
CoW DAO is proposing a discretionary grants program to reimburse victims of the April 14 DNS hijacking incident affecting CoW Swap. CoW Swap describes user protection as a core promise and says the grants are meant to make victims whole as quickly as possible. Because of the high sums involved, the proposal must pass governance before it can take effect, and readers are asked to signal support or give feedback on the CoW DAO forum.
- The U.S. Military Is Running A Bitcoin Node, Admiral Says (bitcoinmagazine.com)
Admiral Samuel Paparo, commander of U.S. Indo-Pacific Command (INDOPACOM), confirmed that the U.S. military is running an active node on the Bitcoin network, which he described as the first known confirmation of a U.S. combatant command directly participating in the network. Paparo said the command is conducting "a number of operational tests to secure and protect networks using the Bitcoin protocol." In Senate Armed Services Committee testimony on April 21, he described Bitcoin as a computer science tool rather than a financial asset, calling it "a peer-to-peer, zero-trust transfer of value." The article estimates there are 15,000 to 20,000 publicly reachable full nodes on the Bitcoin network as of early 2026.
- Yang Haipo: Cryptocurrency is Heading Towards an Inevitable Endgame (wublock.substack.com)
- KelpDAO Attacker (intel.arkm.com)
- Imaginationmaxxing (x.com)
The author's central claim is that imagination has replaced capability as the scarce resource for builders, so the advantage now goes to people who spot newly tractable problems before others do. The article cites Humane's AI Pin, which had $240 million in funding, founders who had designed the iPhone, and @sama as an investor, yet was panned and bricked customers' devices on its way out. It contrasts this with Cursor, which launched in late 2023 to dismissive Hacker News comments and was valued at $29 billion two and a half years later.
- LLM-assisted coding is not deterministic. It does it matter? (blog.vrypan.net)
The article argues that determinism and predictability are different properties, and that for LLM-assisted coding the useful question is which workflow yields more predictable outcomes, not whether the output is deterministic. It explains that a system can be deterministic yet unpredictable, as with weather, where physics is deterministic but measurement limits make forecasts hard, and that software behavior is similarly hard to foresee given the complexity of hardware, libraries and configurations. It notes that end users mainly care whether software behaves correctly most of the time and whether failures are visible and fixable. It cites DO-178C, the aeronautics certification standard, as an objective-based framework that could apply to both human coders and LLMs.
- @aave: WETH reserves unfrozen on Ethereum Core V3, remain frozen on other chains (firefly.social)
- @aave: rsETH reserves paused across Ethereum, Arbitrum, Base, Mantle, Linea (x.com)
- @xcryptopunk: airdrop farmers are sybiling Aave's rsETH charity fund (x.com)
Crypto user @xcryptopunk argues that airdrop farmers are sybiling Aave's rsETH charity fund, a rescue effort for rsETH victims. The post says tier 5 (under 0.001 ETH) has 10,949 wallets, 79% of the total, and that thousands of people are sending exactly $1 to the fund in hopes of a later "thank you" airdrop. It also says tier 4 (0.001 to 0.01 ETH) has 1,060 wallets and calls it the best asymmetric bet compared with the $1 deposits in tier 5.
- Did You Lose Crypto? SOS - Free Emergency Help (securityalliance.org)